“ requirement ” includes a prohibition or restriction.
(5) The reference in subsection (1) to an enactment or rule of law which imposes a duty, or confers a power, to process personal data is a reference to an enactment or rule of law which, directly or indirectly, requires or authorises the processing of personal data, including (for example)—
(a) by authorising one person to require another person to process personal data, or
(b) by removing restrictions on processing personal data,
and the references in subsection (3) to a duty or power are to be read accordingly. ”
(3) Before section 184 (and the italic heading before it) insert—
“ 183B Protection of prohibitions and restrictions etc on processing: other enactments
(1) This section is about the relationship between—
(a) a pre-commencement enactment which imposes a duty, or confers a power, to process personal data, and
(b) a provision of the main data protection legislation containing a requirement relating to the processing of personal data.
(2) The relationship is not changed by section 5(A1) of the European Union (Withdrawal) Act 2018 (removal of the principle of supremacy of EU law) (or the repeal of section 5(1) to (3) of that Act).
(3) Where the provision described in subsection (1)(b) is a provision of, or made under, the UK GDPR, section 5(A2) of the European Union (Withdrawal) Act 2018 (assimilated direct legislation subject to domestic enactments) does not apply to the relationship.
(4) Nothing is to be implied about a relationship described in subsection (1) merely due to the fact that express provision with similar effect to section 183A(1) (or applying that provision) is made in connection with one such relationship but not another.
(a) “ the main data protection legislation ” and “ requirement ” have the same meaning as in section 183A, and
(b) “ pre-commencement enactment ” means an enactment so far as passed or made before the day on which section 106(2) of the Data (Use and Access) Act 2025 comes into force.
(6) Section 183A(5) applies for the purposes of subsection (1)(a) of this section as it applies for the purposes of section 183A(1). ”
(4) In section 186 (data subject’s rights and other prohibitions and restrictions)—
(a) for the heading substitute “Protection of data subject’s rights” ,
(b) in subsection (1) omit “, except as provided by or under the provisions listed in subsection (3)”,
“ (2A) Subsection (1) does not apply—
(a) to an enactment contained in, or made under, a provision listed in subsection (2),
(b) to an enactment contained in, or made under, a provision listed in subsection (3),
(c) to the extent that an enactment makes express provision to the contrary referring to this section or to a provision listed in subsection (2), or
(d) to the extent that subsection (1) is disapplied by section 186A(3). ” , and
(d) in subsection (3)—
(i) for “provisions providing exceptions” substitute “provisions referred to in subsection (2A)(b)” , and